INDEPENDENT ORBITER ASSESSMENT 


ASSESSMENT OF THE 
ASCENT THRUST 
VECTOR CONTROL 
ACTUATOR SUBSYSTEM 


05 FEBRUARY 1986 





MCDONNELL DOUGLAS ASTRONAUTICS COMPANY 
HOUSTON DIVISION 


SPACE TRANSPORTATION SYSTEM ENGINEERING AND OPERATIONS SUPPORT 


WORKING PAPER NO. 1 . 0-WP-VA88003-03 


INDEPENDENT ORBITER ASSESSMENT 
ASSESSMENT OF THE ASCENT THRUST VECTOR CONTROL 
ACTUATOR SUBSYSTEM FMEA/CIL 


05 FEBRUARY 1988 


This Working Paper is Submitted to NASA under 
Task Order No. VA88003, Contract NAS 9-17650 


PREPARED BY 


R.E. Wilson 
Senior Analyst 
Independent Orbiter 
Assessment 


APPROVED BY: 



Secti<^i Manager-FMEA/CIL 
Independent Orbiter 
Assessment 


APPROVED BY: 


G.W. Knori 
Technical Manager 
Independent Orbiter 
Assessment 







CONTENTS 


Page 


1.0 EXECUTIVE SUMMARY 1 

2 . 0 INTRODUCTION 5 

2 . 1 Purpose 5 

2 . 2 Scope 5 

2.3 Analysis Approach 5 

2.4 Ground Rules and Assumptions 6 

3.0 SUBSYSTEM DESCRIPTION 7 

3.1 Design and Function 7 

3.2 Interfaces and Locations 8 

3 . 3 Hierarchy 9 

4.0 ASSESSMENT RESULTS 16 

4.1 Seractuator 20 

4.2 Hydraulic Valve Module 20 

4.3 Primary Piston Assembly 20 

4.4 Failure Comparison 21 

5.0 REFERENCES 23 

APPENDIX A ACRONYMS A-l 

APPENDIX B DEFINITIONS, GROUND RULES, AND ASSUMPTIONS B-l 

B.l Definitions B-2 

B.2 Project Level Ground Rules and Assumptions B-4 

B.3 Subsystem Specific Ground Rules and Assumptions B-6 

APPENDIX C ASSESSMENT WORKSHEETS C-l 

APPENDIX D CRITICAL ITEMS D-l 

APPENDIX E ANALYSIS WORKSHEETS E-l 

APPENDIX F NASA FMEA TO IOA WORKSHEET CROSS F-l 

REFERENCE/RECOMMENDATIONS 


i 



List of Figures 


Page 


Figure 1 - ATVC ACTUATOR FMEA/CIL ASSESSMENT SUMMARY 2 

Figure 2 - ME TVC ACTUATOR BLOCK DIAGRAM 5 

Figure 3 - TYPICAL ACTUATOR ASSEMBLY 9 

Figure 4 - SWITCHING VALVE 10 

Figure 5 — E— H SERVOVALVE ASSEMBLY 11 

Figure 6 - BYPASS VALVE 12 

Figure 7 - POWER SPOOL VALVE ASSEMBLY 13 

Figure 8 - CYLINDER AND PISTON/RAM ASSEMBLY 14 

List of Tables 

Page 

Table I - SUMMARY OF IOA FMEA ASSESSMENT 16 

Table II - SUMMARY OF IOA CIL ASSESSMENT 17 

Table III- SUMMARY OF IOA RECOMMENDED FAILURE 

CRITICALITIES 18 

Table IV - SUMMARY OF IOA RECOMMENDED CRITICAL ITEMS 19 

Table V - IOA WORKSHEET NUMBERS 19 


ii 



Independent Orbiter Assessment 
Assessment of the ATVC Actuator Subsystem FMEA/CIL 


1.0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company (MDAC) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis (FMEA) and Critical Items 
List (CIL) . Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206. Instructions 
for Preparation of FMEA and CIL. 10 October 1986 . 

The IOA effot fist completed and analysis of the Ascent Thrust 
Vector Control Actuator (ATVC) hardware, generating draft failure 
modes and potential critical items. To preserve independence, 
this analysis was accomplished without reliance upon the results 
contained within the NASA FMEA/CIL documentation. The IOA 
results were then compared to the NASA FMEA/CIL baseline with 
proposed Post 51-L updates included. A resolution of each 
discrepancy from the comparison is provided through additional 
analysis as required. This report documents the results of that 
comparison for the Orbiter ATVC hardware. 

The IOA produt for the ATVC actuator analysis consisted of 
twenty-five failure mode "worksheets" that resulted in sixteen 
potential critical items being identified. Comparison was made 
to the NASA baseline (as of 7 December 1987) which consisted of 
(Note 1) twenty-one FMEAs and Thirteen CIL items. The comparison 
dtermined if there were any results which had been found by the 
IOA but were not in the NASA baseline. This comparison produced 
agreement on all CIL items. Based on the Pre 51-L baseline, all 
non-CIL FMEAs were also in agreement. Based on discussions with 
the NASA subsystem manager, no additional non-CIL FMEAs are 
anticipated for the post 51-L update. Figure 1 presents a 
comparison of the proposed Post 51-L NASA baseline, with the IOA 
recommended baseline, and any issues. 

Note 1. The comparison of NASA FMEA Non-CIL item is based on the 
Pre 51-L baseline since all Post 51-L FMEAs have not been 
received as date of this report. 
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* NASA PROPOSED BASELINE AS OF 5 MAY 1987 

* * FINAL NASA CIL ITEMS BASELINE AS OF 7 DECEMBER 1987 AND NASA NON-CIL FMEAS - PRE S1-L BASELINE 





2 . 0 INTRODUCTION 


2 . 1 Purpose 

The 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS) . The NSTS Office has 
undertaken the task of reevaluating the FMEA/CIL for the Space 
Shuttle design. The MDAC is providing an independent assessment 
of the proposed Post 51-L Orbiter FMEA/CIL for completeness and 
technical accuracy. 

2.2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle Independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases. 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items. Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the proposed Post 51-L NASA and Prime 
Contractor FMEA/CIL. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEA/CIL which is 
documented in this report. 


Step 1.0 Subsystem Familiarization 

1.1 Define subsystem functions 

1.2 Define subsystem components 

1.3 Define subsystem specific ground rules and 
assumptions 

Step 2.0 Define subsystem analysis diagram 

2.1 Define subsystem 

2.2 Define major assemblies 

2 . 3 Develop detailed subsystem representations 

Step 3.0 Failure events definition 

3 . 1 Construct matrix of failure modes 

3.2 Document IOA analysis results 
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Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4 . 2 Review in-house 

4 . 3 Document assessment issues 

4.4 Forward findings to Project Manager 

2.4 Ground Rules and Assumptions 

The ground rules and assumptions used in the IOA are defined in 
Appendix B. There were no subsystem specific ground rules and 
assumptions used in this analysis. 
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3.0 


SUBSYSTEM DESCRIPTION 


ORIGINAL PAGE IS 
OF POOR QUALITY 


3.1 Design and Function 

The ATVC servoactuators gimbal the main engines in pitch and yaw 
to provide for attitude and flight path control during ascent. 
There are two Ascent Thrust Vector Control (ATVC) actuators for 
each ME, one for pitch movement and one for yaw movement. Each 
actuator receives four command voltages, one from each ATVC 
driver electronics channel. Each actuator employs two of the 
three Orb iter hydraulic systems (one primary and one secondary) . 
Each METVC servoactuator consists of the following components: 

1. Switching valve. Two Orb iter hydraulic systems are 
connected to the valve. The output from the valve connects 
to four servovalves and to a power spool. The valve will 
shift position when the hydraulic pressure from the 
controlling hydraulic system is less than 1200 to 1500 psi 
and will furnish standby pressure to the actuator. 

2. Four electro-hydraulic servovalves. Each servovalve 
consists of a second-stage valve, a torque motor assembly 
with power valve feedback wire, a mechanical position 
feedback spring cage assembly, a bypass valve, a dynamic 
pressure feedback valve, and a secondary delta pressure 
transducer. The function of the servovalve is to generate 
secondary hydraulic pressure to drive a power spool valve in 
response to position commands from the ATVC electronic 
driver. 

3. Torque motor assembly. The assembly consists of dual 
magnets, a flapper valve and two feedback wires attached to 
the flapper; one wire is linked to the servovalve and the 
other is linked to the power spool valve. The wires are 
used to control the spool velocity. When a command voltage 
generates a torque, it causes the flapper to rotate in a 
clockwise or counterclockwise direction causing a pressure 
buildup in either the right or left sections of the 
servovalve, thus moving the valve to the right or left. 

When the valve is displaced, the hydraulic pressure is 
transferred to the power spool which then transfers 
hydraulic pressure to the primary drive piston. 

4. Mechanical position feedback assembly. The assembly links 
each of the four torque motor flappers to the primary 
piston. The assembly allows the flapper to rotate initially 
in response to a command voltage input, and then 
mechanically moves the flapper back to its neutral position 
as the primary piston reaches its commanded position. 

5. Bypass valve. The bypass valve isolates a servovalve when a 
secondary delta pressure is determined to be bad by the 
ATVC electronics. When an isolation command is issued to a 
solenoid a piston shuttles against a spring. This allows 
hydraulic pressure to shuttle a second piston which inhibits 
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hydraulic flow from the servovalve to the power piston. 

This equalizes pressure on both sides of the hydraulic 
supply which allows the servovalve to float, thus isolating 
it from the system. 

6. Secondary delta pressure transducer. Each servovalve has a 
transducer which measures the resistance its servovalve sees 
relative to the other three servovalves. It sends signals 
to the ATVC electronics which determines which, if any, 
delta pressure is outside allowable limits. If a delta 
pressure fails, the TVC sends an isolation command to the 
bypass valve. 

7. Power spool valve assembly. Each actuator has one power 
spool which provides primary hydraulic pressure to the 
primary piston. The power spool consists of a cylinder that 
contains a linear power spool. The power spool has a 
central position whose motion is driven by the summation of 
the secondary delta pressure from the four servovalves. 

When the power spool is displaced, hydraulic fluid is 
directed through a lock valve to the primary piston. The 
lock valve hydraulically isolates the cylinder and primary 
piston from the hydraulic source to prevent further movement 
of the primary piston. If there is a hydraulic failure, the 
lock valve spool moves (due to spring pressure) to a closed 
position which locks the primary piston in its last 
commanded position. A force limiter valve limits internal 
cylinder pressure to 4050 psi. (The valve was used during 
the OFT program to determine side loads during main engine 
gimbaling.) The valve is functionally non-critical . 
Instrumentation has been removed from the Orbiter. 

8. Cylinder and ram/piston assembly. The assembly produces 
linear motion (extend or retract) to move the SSME in pitch 
or yaw, and mechanical position feedback cam and a feedback 
scissor assembly which connects to the mechanical position 
feedback spring cage assembly. The main cylinder reservoirs 
receive hydraulic pressure or return the Orbiter hydraulic 
supply through the feed/return lines leading to the power 
valve via the lock valve. As the ram moves, the scissor 
assembly contracts or expands, pushing the mechanical 
linkage (up or down) which moves the torque motor flapper. 
When the piston/cam reaches its commanded position, the 
feedback assembly removes secondary fluid pressures to the 
power valve. 

3.2 Interfaces and Locations 

The ATVC servoactuators interface with the four ATVC electronics 
drivers which receive commands via four MDMs from the four GPCs. 
Crew initiated command inputs are through the GPCs. The crew can 
turn power on or off to any ATVC channel and place a FCS channel 
in OVERRIDE which bypasses the ATVC fault detection circuitry. 
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Each actuator is fastened to the Orbiter thrust structures and 
to the powerhead of one of the three SSMEs. 

Crew inputs fall into three areas, rotational hand controller 
(RHC) commands, override commands and ATVC power. 

The FA MDMs and the ATVC electronic drives are located in 
Avionics Bays 4 , 5 and 6 . 

FCS channel monitor switches are located on Panel C3 . The ATVC 
power switches are located on Panel 017. 

The two displays relative to MPS ATVC are the caution and warning 
(C&W) matrix (Panel F7) and the GNC System Summary 1 display. 

The GNC System Summary 1 display (PASS and BFS) shows a down 
arrow for an FCS channel that has isolated a failed servovalve 
and a fault message. 

3.3 Hierarchy 

Figure 2 is a block diagram of the ATVC servo actuators. Figures 
3 through 8 show components which were analyzed for failure 
modes . 




CDQCO 

cc >- >- 
oiw 


Figure 2 - ME TVC ACTUATOR BLOCK DIAGRAM 
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Figure 5 - E-H SERVOVALVE ASSEMBLY 
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4 . 0 ASSESSMENT RESULTS 


The IOA analysis of the ATVC actuator hardware initially 
generated twenty-five failure mode worksheets and identified 
sixteen Potential Critical Items (PCIs) before starting the 
assessment process. The results were compared to the proposed 
Post 51-L baseline (5 May 1987) of (Note 1) twenty-one FMEAs and 
fifteen CIL items and the updated (7 December 1987) version of 
(Note 1) twenty-one FMEAs and thirteen CIL items. The 
discrepancy between the number of IOA and NASA FMEAs can be 
explained by the different approach used by NASA and IOA to group 
modes. Upon completion of the assessment and after discussions 
with the NASA subsystem manager, an agreement between the NASA 
FMEA/CIL items and the IOA failure modes was reached. 

Note 1. Have received Post 51-L CIL Items Only. Have not 
received all the Post 51-L NASA FMEAs as of the date of this 
report. Non-CIL items comparison was based on review of NASA Pre 
51-L baseline and IOA analysis. 

In the following, the unmapped IOA column is the raw number of 
IOA failure modes. The mapped IOA column is the number of IOA 
failuremodes after they have been mapped into the NASA FMEAs. 

The issues column is the IOA failure modes that were unable to 
be mapped into NASA FMEAs. 


ATVC Actuator 
Elements 

IOA 

Unmapped 

IOA 

Mapped 

NASA 

Issues 

Hydraulic Valve 

Module 

20 

17 

17 

0 

Servoactuator 

3 

2 

2 

0 

Primary Piston 
Assembly 

2 

2 

2 

0 


— 

— 

— 

— 


25 

21 

21 

0 

Appendix C presents 

the detailed 

assessment 

worksheets 

for each 


failure modes identified and assessment. Appendix D highlights 
the NASA critical items and corresponding IOA worksheet ID. 
Appendix E contains IOA analysis worksheets supplementing 
previous analysis results reported in STS Engineering and 
Operations Support (STSEOS) Working Paper 1 . 0-WP-VA86001-06 , 
Analysis of the ATVC actuator, 3 December 1986. No supplemtal 
analysis worksheets were generated for the ATVC assessment. 
Appendix F provides a cross reference between the NASA FMEA and 
corresponding IOA worksheets. IOA recommendations are also 
summarized. 
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A summary of the quantity of NASA FMEAs assessed, versus the 
recommended IOA baseline and any issues identified is presented 
in Table I. 


NASA 

IOA 

2 

2 


Table I Summary of IOA FMEA Assessment 


Component NASA IOA Issues 


o Servoactuator 
o Hydraulic Valve Module 
Elements 
o Switch Valve 
o E-H Servovalve 
o Filter 
o Bypass Valve 
o Sec. Delta P X-DCER 
o Power Spool 
o Check Valve 
o Lock Valve 
o Force Limiter Valve 
o Dynamic Press Fdble 
Valve 

o Flow Cutoff Valve 
o Primary Piston Assy 
o Mech. Fdble. Assy 
o Cylinder and Ram/ 
Piston 


TOTAL 























A summary of the quantity of NASA CIL items assessed, versus the 
recommended IOA baseline, and any issues identified is presented 
in Table II. 


Table II Summary of IOA CIL Assessment 

Component 

NASA 

IOA 

Issues 

o Servoactuator 

2 

2 

0 

o Hydraulic Valve Module 
Elements 
o Switch Valve 

1 

1 

0 

o E-H Servovalve 

1 

1 

0 

o Filter 

1 

1 

0 

o Bypass Valve 
o Sec. Delta P X-DCER 
o Power Spool 

1 

1 

0 

o Check Valve 

2 

2 

0 

o Lock Valve 

2 

2 

0 

o Force Limiter Valve 
o Dynamic Press Fdble 
Valve 

1 

1 

0 

o Flow Cutoff Valve 
o Primary Piston Assy 
o Mech. Fdble. Assy 

1 

1 

0 

o Cylinder and Ram/ 
Piston 

1 

1 

0 

TOTAL 

13 

13 

0 

















Table III presents a summary of the IOA recommended failure 
criticalities for the Post 51-L FMEA baseline. Further 
discussion of each of these subdivisions and the applicable 
failure modes is provided in subsequent paragraphs. 


TABLE III Summary 

of IOA Recommended 

Failure Criticalities 

Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

o Servoactuator 

1 

1 





2 

o Hydraulic Valve 








Module Elements 








o Switch Valve 


1 





1 

o E-H Servovalve 


1 


1 



2 

o Filter 

1 





1 

2 

o Bypass Valve 




1 



1 

o Sec. Delta P X-DCER 




1 



1 

o Power Spool 

1 






1 

o Check Valve 

1 

1 





2 

o Lock Valve 

2 






2 

o Force Limiter Valve 






2 

2 

o Dynamic Press Fdble 








Valve 




1 



1 

o Flow Cutoff Valve 






2 

2 

o Primary Piston Assy 








o Mech. Fdble. Assy 

1 






1 

o Cylinder and Ram/ 








Piston 

1 






1 

TOTAL 

8 

4 

- 

4 

- 

5 

21 


I 


1 


18 












Of the failure inodes analyzed, fifteen were determined to be 
critical items. A summary of the IOA recommended critical items 
is presented in Table IV. 


TABLE IV Summary of IOA Recommended Failure Criticalities 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

o Servoactuator 
o Hydraulic Valve 

1 

1 





2 

Module Elements 
o Switch Valve 


1 





i 

o E-H Servovalve 


1 





1 

o Filter 
o Bypass Valve 

1 






i 

o Sec. Delta P X-DCER 
o Power Spool 

1 






i 

o Check Valve 

1 

1 





2 

o Lock Valve 
o Force Limiter Valve 
o Dynamic Press Fdble 

2 






2 

Valve 

o Flow Cutoff Valve 




1 



1 

o Primary Piston Assy 








o Mech. Fdble. Assy 
o Cylinder and Ram/ 

1 






1 

Piston 

1 






1 

TOTAL 

8 

4 


1 

- 

- 

13 


The scheme for assigning IOA assessment (Appendix C) and analysis 
(Appendix E) worksheet numbers is shown in Table V. 


Table V IOA Worksheet Numbers 

Component 

IOA ID Number 

o Servoactuator 

ATVC-101 thru ATVC-103 

o Hydrauliv Valve 

ATVC-104 thru ATVC-120 

o Primary Piston 

ATVC-12 1 thru ATVC-125 

Assembly 
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4 . 1 Servoactuator 


Failures which were related to the servoactuator as an entity 
were first analyzed. Critical failures were associated with 
gross loss of hydraulic fluid due to complete seal failure, and 
hydraulic manifold rupture. Hydraulic fluid loss was also 
caused by component rupture such as EH servovalves, dynamic 
pressure feedback valves, force limiter valves and lock valves. 
There were no differences between the IOA and NASA analysis. 

4.2 Hydraulic Valve Module 

Components of the hydraulic valve module were individually 
analyze. Most critical failures of these components included 
loss of command signal input; check, power, switch and lock valve 
failures due to contamination, clogged filters. One IOA failure, 
ruptured filter, was determined to be a non-credible failure 
during the assessment process. Since no known conditions could 
exist that would rupture the filter no FMEA was considered 
necessary. Two failures (open/closed) of the dynamic pressure 
feedback valves were identified by the IOA which had not been 
included in the pre-51L NASA FMEA/CIL. The. function of the 
valves is to apply a damping force at the servovalve assembly to 
damp engine resonance during periods of high vibrating. The 
original IOA analysis considered the failures to be non-critical . 
There failure modes were discussed with NASA. Further analysis 
by RI showed that the failures were critical and could cause the 
actuators to become unstable resulting in possible loss of engine 
control. A criticality of 3/1R with FFP of screens was assigned 
the failures. The only other differences were minor and involved 
pass/fail of redundancy screen B for three criticality 2/1R 
items. Two IOA failures assigned a criticality of 2/1R were 
downgraded to 3/1R; and one other IOA failure (3/3) was upgraded 
to 3/1R during the assessment process. 

4.3 Primary Piston Assembly 

Critical failures associated with the primary ram/piston assembly 
were due to mechanical failures, fractures and jammed components. 
These failures module jamming or separation of the mechanical 
position feedback spring cage assembly, loss of the piston rod 
gland retention in the main body, and fracture of the tail stock 
(thrust structure) , piston rod end (engine) , piston head and 
piston rod. There were no differences between the IOA and NASA 
analysis. 
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4.4 Failure Comparison 

The main reason for IOA intially having more CIL items than NASA 
was that NASA combined failure of components which had the same 
effect, whereas the IOA wrote failure sheets for each item. 

Review of the NASA CIL items showed that all of the IOA failures 
had been analyzed. Since the combined failures all resulted in 
the same effect it was concluded that there were no issues with 
IOA. Minor differences such as pass or fail of screens were 
readily resolved. Frequent discussions with the subsystem 
manager resulted in a better understanding of the system and 
component operation. As a result of these discussions several 
IOA criticalities were downgraded. In addition, an additional 
failure mode not included in the Pre 51-L NASA FMEAs was added to 
the Post 51-L baseline. 
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22206, 10 October 1986 


22 



APPENDIX A 
ACRONYMS 


ATVC 

- 

Ascent Thrust Vector Control 

BFS 

- 

Backup Flight System 

C&W 

- 

Caution and Warning 

CIL 

- 

Critical Items List 

CRT 

- 

Cathode Ray Tube 

delta P 

- 

Differential Pressure 

E-H Servo VLV 

- 

Electro-Hydraulic Servovalve 

F 

- 

Functional 

FCS 

- 

Flight Control System 

FMEA 

- 

Failure Modes Effect Analysis 

GNC 

- 

Guidance Navigation and Control 

GPC 

- 

General Purpose Computer 

HW 

- 

Hardware 

IOA 

- 

Independent Orbiter Assessment 

MDAC 

- 

McDonnell Douglas Astronautics Company 

MDM 


Multiplexer/Demultiplexer 

METVC 

- 

Main Engine Thrust Vector Control 

ORIDE 

- 

Override 

PASS 

- 

Primary Avionics Software System 

RI 

- 

Rockwell International 

RHC 

- 

Rotational Hand Controller 

SSME 

- 

Space Shuttle Main Engine 

SRB 

- 

Solid Rocket Booster 
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APPENDIX B 


DEFINITIONS , GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

B.2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 
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APPENDIX B 

DEFINITIONS , GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

Definitions contained in NSTS 22206, Instructions For Preparation 
of FMEA/CIL. 10 October 1986 . were used with the following 
amplifications and additions. 

INTACT ABORT DEFINITIONS: 

RTLS - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 

TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

AOA - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

ATO - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

CREDIBLE ( CAUSE) - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 

CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

EARLY MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /RATIONALE - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE (MM) - major sub-mode of software operational sequence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
(PASS) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/objective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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MULTIPLE ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS: 

PRELAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING/SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B. 2 IOA Project Level Ground Rules and Assumptions 

The philosophy embodied in NSTS 22206, Instructions for 
Preparation of FMEA/CIL. 10 October 1986 . was employed with the 
following amplifications and additions. 


1. The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
(FSSRs) . 

RATIONALE: Software verification is out-of-scope of 
this task. 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (C&W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3. Any data employed with flight software is assumed to be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All hardware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures caused by human operational error 
are out-of-scope of this task. 
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6. All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs, and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail. 

7. Verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required. 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

8. The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 

any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

9. Analysis of wire harnesses, cables, and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

10. Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

11. Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP) , pressure 
relief valves and the landing gear pyrotechnics. 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B. 3 ATVC Actuator - Specific Ground Rules and Assumptions 

The IOA analysis was performed to the component or assembly 
level of the ATVC actuator. The analysis considered the 
worst case effects of the hardware or functional failure on 
the subsystem, mission and crew and vehicle safety. 
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APPENDIX C 
DETAILED ASSESSMENT 

This section contains the IOA assessment worksheets generated 
during the Assessment of the Ascent Thrust Vector Control 
Actuator Subsystem. The information on these worksheets 
facilitates the comparison of the NASA FMEA/CIL (Pre and Post 51- 
L) to the IOA detailed analysis worksheets included in Appendix 
E. Each of these worksheets identifies the NASA FMEA being 
assessed, corresponding MDAC Analysis Worksheet ID (Appendix E) , 
hardware item, criticality, redundancy screens, and 
recommendations. For each failure mode, the highest assessed 
hardware and functional criticality is compared and discrepancies 
noted as "N" in the compare row under the column where the 
discrepancy occurred. 


LEGEND FOR IOA ASSESSMENT WORKSHEETS 


Hardware Criticalities: 

1 — Loss of life or vehicle 

2 = Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 * All others 

Functional Criticalities: 

1R = Redundant hardware items (like or unlike), all of which, 
if failed, could cause loss of life or vehicle 
2R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission 

Redundancy Screens A, B and C: 

P - Passed Screen 
F = Failed Screen 
NA = Not Applicable 

NASA Data : 

Baseline - NASA FMEA/CIL 

New - Baseline with Proposed Post 51-L Changes 

CIL Item : 

X * Included in CIL 
Compare Row : 

N * Non compare for that column (deviation) 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-101 

NASA FMEA #: 02-6-A01-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

101 

METVC SERVO ACTUATOR (6) 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

c 

ITEM 

NASA 

[1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA 

[1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

COMPARE 

[ / ] 

[ 3 

[ 3 

[ 3 

[ 

RECOMMENDATIONS : 

(If different 

from NASA) 



[ / ] 

[ 3 

[ 3 

[. 3 

[ 


(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

THE NASA FMEA COVERS FAILURES WHICH WERE WRITTEN AS SEPARATE 
FAILURES BY IOA; ATVC-101 AND ATVC-102. NO DISAGREEMENT WITH 
COMBINING FAILURES UNDER ONE FMEA. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-102 

NASA FMEA #: 02-6-A01-1 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

102 

METVC SERVO ACTUATOR (6) 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

c 


NASA 

[i/i 3 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA 

[l/i 3 

[ NA] 

[ NA] 

[ NA] 

[ x 

COMPARE 

[ / 3 

[ 3 

[ 3 

[ 3 

[ 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



[ / 3 ' 

[ 3 

[ 3 

[ 3 

[ 


(ADD/DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 


REMARKS: 

THE NASA FMEA COVER FAILURE'S WHICH WERE 


ADEQUATE [ X ] 
INADEQUATE [ ] 

WRITTEN AS SEPARATE 


FAILURES BY IOA; ATVC-101 AND ATVC-102. NO DISAGREEMENT WITH 
COMBINING BOTH FAILURES UNDER ONE FMEA. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-103 

NASA FMEA #: 02-6-A01-13 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

103 

METVC SERVO ACTUATOR (6) 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [ 2 /1R ] 

[ F ] 

[ F ] 

[ P 1 

[ X ] 

IOA [ 2 /1R ] 

[ F ] 

[ P 1 

[ P ] 

[ X ] 

COMPARE [ / ] 

[ ] 

[ N ] 

[ ] 

[ ] 


RECOMMENDATIONS: (If different from NASA) 

i / ] [][][] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA CRITICALITY. NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-104 

NASA FMEA #: 02-6-A01-SW-4 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

104 

SWITCH VALVE (6) 


* 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS CIL 


FLIGHT ITEM 

HDW/FUNC ABC 


NASA [ 2 /1R ] [ P ] [ F ] [ P ] 

IOA [ 2 / 1R ] [ P ] [ P ] [ P ] 


C X ] * 
[ X ] 


COMPARE [ / ] [ ] [ N 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ ] [ ] [ ] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

AGREE THAT FAILURE FAILS REDUNDANCY SCREEN B. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

LEAD ANALYST: 


12/07/86 

ATVC-105 

02-6-A01-5 

ATVC 

105 

EH SERVOVALVE ASSY 
R. WILSON 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA 

[ 3 /1R ] 

[ P ] 

[ P ] 

[ P ] 

[ X ] * 

IOA 

[ 2 /1R ] 

[ P ] 

[ F ] 

[ P ] 

[ x ] 

COMPARE 

[ N / ] 

[ ] 

[ N ] 

[ ] 

[ ] 


RECOMMENDATIONS : 


(If different from NASA) 


[ / 


[ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REMARKS: 

CONCUR WITH RI/NASA THAT A HARDOVER FAILURE OF THE SERVOVATVEIS 
DETECTABLE AND CAN BE ISOLATED, LEAVING THREE GOOD SERVOVALVES . 
NASA INCLUDED THIS FAILURE AMONG OTHER FAILURES HAVING THE SAME 
EFFECT IN FMEA 02-6-A01-5. THERE IS NO DISAGREEMENT WITH 
INCLUDING THE FAILURES IN THE SAME FMEA. FAILURES ARE COVERED BY 
MDAC ID 105, 109 AND 110. 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/86 

ATVC-106 

02-6-A01-SV-19 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

106 

EH SERVOVALVE ASSY 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA [ 2 /1R ] 
IOA [ 2 /1R ] 


[ P ] [ F ] [ P ] 

[ P ] [ F ] [ P ] 


[ X ] * 

[ X ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ 3 [ ] [ . 3 [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

IF THE FAILURE OCCURS WHEN COMMANDING AT OR NEAR THE NULL 
POSITION, THE FAULT DETECTION CIRCUITRY CANNOT DETECT THE 
FAILURE. THIS FAILURE WOULD GO UNDETECTED AND THE NEXT FAILURE 
WOULD LEAVE TWO OPERATING CHANNELS. THE HARDWARE IS 3/1R; 
HOWEVER, THE FAULT DETECTION CIRCUITRY CANNOT DETECT WHICH OF THE 
2 CHANNELS IS GOOD IF ONE SHOULD FAIL. THIS COULD RESULT IN A 
POSSIBLE FORCE FLIGHT BETWEEN THE TWO CHANNELS WITH A RESULTING 
LOSS OF CONTROL. 


NO CRITICALITY ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA # : 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

LEAD ANALYST: 


12/07/86 

ATVC-107 

02-6-A01-FE-3 

ATVC 

107 

FILTER 
R. WILSON 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA [1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ ] [ 1 [ ] [ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


[ X ] 

C ] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-108 
NASA FMEA #: NONE 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: ATVC 

MDAC ID: 108 

ITEM: FILTER 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY 

SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 


c 

ITEM 

NASA 

[ / ] 

[ ] [ 


] 

[ 3 

[ 3 

IOA 

[3/3 ] 

[ P ] [ 

F 

3 

[ P 3 

[ 3 

COMPARE 

[ N /N ] 

[ N ] [ 

N 

3 

[ N ] 

[ 3 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



C / 3 

C. ] [ 


3 

[ 3 

[ 3 


(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

AGREE WITH NASA. THIS IS A NON-CREDIBLE FAILURE SINCE NO 
KNOWN CONDITIONS COULD EXIST WHICH WOULD RUPTURE THE FILTER. 
NASA CIL PRE-BOARD ACTIVE - DELETE AS BEING A NON-CREDIBLE 
FAILURE . 


NO ISSUE. INITIAL ANALYSIS WAS IN ERROR SHOWING PASS OR 
FAIL OF SCREENS. FAIL OR PASS OF SCREENS SHOULD BE NOT 
APPLICABLE. 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-109 

NASA FMEA #: 02-06-A01-5 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

109 

TORQUE MOTOR ASSY 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

C 3 /1R ] 

[ P 3 

[ P 3 

[ P 3 

[ 

IOA 

t 2 /1R ] 

[ P 3 

[ F ] 

[ P 3 

[ x 

COMPARE 

[ N / ] 

[ 3 

[ N ] 

[ 3 

[ N 


RECOMMENDATIONS : (If different from NASA) 

C / 3 [ ] [ ] [ ] C ] 

(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE ( ] 

INADEQUATE [ ] 

REMARKS: 

NASA INCLUDED THIS FAILURE AMONG OTHER FAIL URES WHICH HAVE 
THE SAME EFFECT IN ONE FMEA . THERE IS NO DISAGREEMENT WITH 
INCLUDING THE FAILURE IN THE SAME FMEA. FAILURES ARE COVERED BY 
MDAC ID 105, 109 AND 110. 

NO ISSUE. CONCUR WITH RI/NASA THAT THIS FAILURE OF THE 
SERVOVALVE MOTOR IS THE SAME AS HARDOVER FAILURE (MDAC ID 105) 
WHICH IS DETECTABLE, CAN BE ISOLATED AND LEAVES THREE GOOD 
CHANNELS. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

LEAD ANALYST: 


12/07/86 

ATVC-110 

02-06-A01-5 

ATVC 

110 

TORQUE MOTOR ASSY 
R. WILSON 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY 

SCREENS 

CIL 


FLIGHT 

HDW/FUNC 

A 

B 


c 

ITEM 

NASA 

[ 3 /1R ] 

[ P ] 

[ P 

3 

[ P 3 

t 3 * 

IOA 

[ 2 /1R ] 

[ P ] 

[ F 

3 

[ P 3 

[ x ] 

COMPARE 

[ N / ] 

[ ] 

[ N 

3 

[ 3 

t N ] 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



[ / ] 

[ 3 

[ 

3 

[ 3 

[ 3 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

NASA INCLUDED THIS FAILURE AMONG OTHER FAILURES WHICH HAVE 
THE SAME EFFECT IN FMEA 02-06-A01-5. THERE IS NO DISAGREEMENT 
WITH INCLUDING THE FAILURE IN THE SAME FMEA. FAILURES ARE 
COVERED MDAC ID 105, 109, AND 110. 

NO ISSUE. CONCUR WITH RI/NASA THAT THIS FAILURE OF THE 
SERVOVALVE MOTOR FLAPPER IS THE SAME AS HARDOVER FAILURE (MDAC ID 
105) WHICH IS DETECTABLE, CAN BE ISOLATED AND LEAVES THREE GOOD 
CHANNELS. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/86 

ATVC-111 

02-6-A01-FB-14 


NASA DATA: 
BASELINE [* ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

111 

MECHANICAL POSITION FEEDBACK SPRING CAGE ASSY 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

c 

ITEM 

NASA 

[1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA 

[ 1 /I 3 

[ NA] 

[ NA] 

[ NA] 

[ x 

COMPARE 

[ / ] 

C 3 

[ 3 

[ ] 

[ 


RECOMMENDATIONS: (If different from NASA) 


[ / ] [ ] C 3 [ 1 [ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


[ X ] 
[ ] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

LEAD ANALYST: 


12/07/86 

ATVC-112 

02-6-A01-11 

ATVC 

112 

BYPASS VALVE 
R. WILSON 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA [ 3 /1R ] [ P ] [ P ] [ P ] 

IOA [ 3 /1R ] [ P ] [ P ] [ P ] 


[ ] * 

[ ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 


[ / 


[ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS: 

NO ISSUE. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-113 

NASA FMEA #: 02-6-A01-12 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

113 

SECONDARY DELTA-P TRANSDUCER 


LEAD ANALYST: 


R. WILSON 


ASSESSMENT: 


CRITICALITY 

FLIGHT 

HDW/FUNC 

NASA [ 3 /1R ] 

IOA [ 2 /1R ] 

COMPARE [ N / ] 


REDUNDANCY SCREENS 


[ P ] 
[ P ] 

[ ] 


[ P ] 

[ F ] 
[ N ] 


[ P ] 
[ P ] 


CIL 

ITEM 


[ ] 
[ X ] 

[ N ] 


RECOMMENDATIONS ! 


[ / ] 


(If different from NASA) 


[ ] 


[ ] 


[ ] 


C ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 

REMARKS • 

NO CRITICALITY ISSUE. AGREE WITH NASA ASSESSMENT, FAILURE OF ONE 
TRANSDUCER IS DETECTABLE AND LEAVES THREE GOOD TRANSDUCERS FOR 
REMAINING SERVO CHANNELS. 


REPORT DATE 02/03/88 


C-14 



APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA # : 


12/07/86 

ATVC-114 

02-6-A01-PS-2 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID; 
ITEM: 


ATVC 

114 

POWER SPOOL VALVE ASSY 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY REDUNDANCY SCREENS CIL 

FLIGHT ITEM 

HDW/FUNC ABC 

NASA [ 1 /I ] [ NA] [ NA] [ NA] [ X ] * 

IOA [ 1 /I ] [ NA] [ NA] [ NA] [ X ] 

COMPARE [ / ] [][][] [ ] 


RECOMMENDATIONS: (If different from NASA) 


[ / ]. [ 

* CIL RETENTION RATIONALE: 
REMARKS: 


] [ 1 C ] C ] 

(ADD/ DELETE) 

(If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/86 

ATVC-115 

02-06-A01-CV-16 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

115 

CHECK VALVE 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 

CRITICALITY REDUNDANCY SCREENS CIL 



FLIGHT 

HDW/FUNC 

A 

B 

C 

ITEM 

NASA 

[ 1 /l ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA 

[1/1 ] 

[ NA] 

[ NA) 

[ NA] 

[ x 

COMPARE 

[ / ] 

[ ] 

[ ] 

[ ] 

[ 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ ] t ] C ] [ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/86 

ATVC-116 

02-6-A01-CV-17 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

116 

CHECK VALVE 


LEAD ANALYST: R. WILSON 

ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

C 


NASA 

[ 2 /1R ] 

[ F ] 

[ F ] 

[ P ] 

[ X ] * 

IOA 

[3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ ] 

COMPARE 

[ N /N ] 

[ N ] 

[ N ] 

[ N ] 

[ N ] 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



[ / ] 

[ ] 

[ ] 

[ ] 

[ ] 

/ nn /T\T?T X?rn- 


(ADD/ DELETE) 


* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

CONCUR WITH NASA CRITICALITY. THE ORIGINAL IOA ANALYSIS 
CONSIDERED THAT IN THE EVENT OF LOSS OF HYDRAULIC PRESSURE AND 
THE CHECK VALVE FAILS OPEN THAT THE ACTUATOR LOCK VALVE ALSO HAD 
TO FAIL OPEN TO CAUSE A PROBLEM. HOWEVER, DISCUSSIONS WITH 
SUBSYSTEM MANAGER INDICATES THAT WITH HIGH HINGE MOMENTS THE BACK 
PRESSURE EXERTED ON THE LOCK VALVE WILL PREVENT LOCK VALVE FROM 
FUNCTIONING AND THE ENGINE CAN GO HANDOVER THEN THE LOCK VALVE 
WILL FUNCTION AND LOCK THE ENGINE AT THIS FUNCTION. 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID : ATVC-117 

NASA FMEA #: 02-6-A01-LV-9 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

117 

LOCK VALVE 


LEAD ANALYST: 


R. WILSON 


ASSESSMENT: 


CRITICALITY 

FLIGHT 

HDW/FUNC 

NASA [1/1 ] 

IOA [1/1 ] 

COMPARE [ / ] 


REDUNDANCY SCREENS 


[ NA] 
[ NA] 

[ ] 


[ NA] 
[ NA] 

[ ] 


[ NA] 
[ NA] 

[ ] 


CIL 

ITEM 


[ X ] * 
[ X ] 


[ ] 


RECOMMENDATIONS: (If different from NASA) 


[ / ] 


[ ] [ ] [ ] 


* CIL RETENTION RATIONALE: (If applicable) 


ADEQUATE [ X ] 
INADEQUATE [ ] 


REMARKS: 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/86 

ATVC-118 

02-6-A01-LV-10 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

118 

LOCK VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

C 


NASA 

[1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

IOA 

[1/1 ] 

[ NA] 

[ NA] 

[ NA] 

[ x 

COMPARE 

[ / ] 

[ ] 

[ ] 

[ ] 

[ 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



[ / 3 

[ ] 

[ ] 

[ ] 

[ 


(ADD/ DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


C X ] 
[ 1 


Li 

r j 


it 


t i 



r-i 


il 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE : 12/07/86 
ASSESSMENT ID: ATVC-119 

NASA FMEA #: 02-6-A01-7 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 1 
119 ■ 
FORCE LIMITER VALVE 


LEAD ANALYST: 


R. WILSON 


ASSESSMENT: 



CRITICALITY 

FLIGHT 

HDW/FUNC 

REDUNDANCY SCREENS 
ABC , 

CIL 

ITEM 

NASA 

IOA 

[3/3 ] 

[3/3 ] 

[ NA] 
[ NA] 

[ NA] 
[ NA] 

[ NA] 
[ NA] 

[ 3 * 

[ 3 

COMPARE 

[ / ] 

[ 3 

[ ] 

[ 3 

[ 3 

RECOMMENDATIONS : (If 

different 

from NASA) 



t / 3 

[ 3 

[ 3 

[ 3 

[ 3 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


] 

] 


I 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-120 

NASA FMEA #: 02-6-A01-8 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

120 

FORCE LIMITER VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 


CRITICALITY 

REDUNDANCY SCREENS 

CIL 

FLIGHT 




ITEM 

HDW/FUNC 

A 

B 

C 


NASA [3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 3 

IOA [3/3 ] 

[ NA] 

[ NA] 

[ NA] 

[ 3 

COMPARE [ / ] 

[ 3 

[ 3 

[ ] 

[ 3 


RECOMMENDATIONS: (If different from NASA) 

[ / ] C ] [ ] C ] [ ] 

(ADD/ DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


] 

1 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 
ASSESSMENT ID: ATVC-121 

NASA FMEA #: 02-6-A01-6 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

121 

CYLINDER AND RAM/PISTON ASS'Y 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 

CRITICALITY 

FLIGHT 

HDW/FUNC 

NASA [1/1 ] 

IOA [1/1 ] 


REDUNDANCY SCREENS 

A B C 

[ NA] [ NA] [ NA] 

[ NA] [ NA] [ NA] 


CIL 

ITEM 


[ X ] * 

[ X ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ ] [ ] C ] C ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE 

INADEQUATE 


[ X ] 

[ ] 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 


12/07/86 

ATVC-122 

02-06-A01-FA-23 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

122 

DYNAMIC PRESSURE FEEDBACK VALVE 


LEAD ANALYST: R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

c 


NASA 

[ 3 /1R ] 

[ F ] 

[ F ] 

[ p ] 

[ x 

IOA 

[3/3 ) 

[ NA] 

[ NA] 

[ NA] 

[ 

COMPARE 

r — i 

55 

\ 

i i 

[ N ] 

[ N ] 

[ N ] 

[ N 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



[ / ] 

[ ] 

[ ] 

[ ] 

[ 


(ADD/DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

THIS FAILURE WAS NOT INCLUDED IN THE NASA PRE 51-L BASELINE. FOR 
THE POST 51-L UPDATE NASA/RI AGREED TO THIS FAILURE BUT HAVE MADE 
IT A 3/1R CRIT, AND A CIL ITEM BASED ON FAILURE OF SCREENS A AND 
B. BASED ON DISCUSSIONS WITH NASA, IOA CONCURS WITH 
THE HEWFMEA/CIL. TkERETS FURTHER AGREEMENT THAT "ONE FMEA/ CIL 
COVERS BOTH ATVC-122 AND ATVC-123 FAILURES. IOA CONCURS WITH 
NASA/RI. (LOSS OF THREE OF THE FOUR VALVES COULD RESULT IN AN 
UNSTABLE ATUATOR UNDER CERTAIN VIBRATION CONDITIONS WHICH 
COULD RESULT IN LOSS OF VEHICLE CONTROL.) 


REPORT DATE 02/03/88 
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APPENDIX C 
ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 12/07/86 NASA DATA: 

ASSESSMENT ID: ATVC-123 BASELINE [ ] 

NASA FMEA #: 02-06-A01-FA-23 NEW [ X ] 


SUBSYSTEM: 
MDAC ID: 
ITEM: 


ATVC 

123 

DYNAMIC PRESSURE FEEDBACK VALVE 


LEAD ANALYST: 


R. WILSON 


ASSESSMENT: 



CRITICALITY 

REDUNDANCY SCREENS 

CIL 


FLIGHT 




ITEM 


HDW/FUNC 

A 

B 

C 


NASA 

t 3 /1R ) 

[ F ] 

[ F ] 

[ P 3 

[ x 3 

IOA 

[3/3 ] 

[ NA) 

[ NA] 

[ na] 

[ 3 

COMPARE 

[ /N ] 

[ N ] 

[ N 3 

[ N 3 

[ N 3 

RECOMMENDATIONS : (If 

different 

from 

NASA) 



C / ] [][][] [ 3 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ X ] 
INADEQUATE [ ] 

REMARKS: 

THIS FAILURE WAS NOT INCLUDED IN THE NASA PRE 51-L BASELINE. FOR 
THE POST 51-L UPDATE NASA/RI AGREED TO THIS FAILURE BUT HAVE MADE 
IT A 3/1R CRIT, AND A CIL ITEM BASED ON FAILURE OF SCREEN A AND 
B. BASED ON DISCUSSIONS WITH NASA, IOA CONCURS WITH 
THE NEW FMEA/CIL. THERE IS FURTHER AGREEMENT THAT ONE FMEA/ CIL 
WILL COVER BOTH ATVC-123 AND ATVC-122 FAILURES. IOA CONCURS WITH 
NASA/RI. (LOSS OF THREE VALVES COVERED RESULT IN AN UNSTABLE 
ACTUATOR UNDER CERTAIN VIBRATION CONDITIONS WHICH COULD 
RESULT IN LOSS OF VEHICLE CONTROL) . 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


ASSESSMENT DATE: 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

LEAD ANALYST: 
ASSESSMENT: 


12/07/86 

ATVC-124 

02-6-A01-21 

ATVC 

124 

FLOW CUTOFF VALVE 
R. WILSON 


NASA DATA: 
BASELINE [ ] 

NEW [ X ] 


CRITICALITY REDUNDANCY SCREENS 

FLIGHT 

HDW/FUNC ABC 


CIL 

ITEM 


NASA [ 3 /3 ] [ NA] [ NA] [ NA] 

IOA [ 3 /3 ] [ NA] [ NA] [ NA] 


[ ] * 

[ ] 


COMPARE [ / 


] 


RECOMMENDATIONS: (If different from NASA) 

[ / ] [ ] C ] [ ] [ ] 

(ADD/ DELETE) 

* CIL RETENTION RATIONALE: (If applicable) 

ADEQUATE [ ] 

INADEQUATE [ ] 


REMARKS: 


REPORT DATE 02/03/88 
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APPENDIX C 

ASSESSMENT WORKSHEET 


12/07/86 

ATVC-125 

02-6-A01-22 


ASSESSMENT DATE : 
ASSESSMENT ID: 
NASA FMEA #: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

LEAD ANALYST: 


ATVC 

125 

FLOW CUTOFF VALVE 


NASA DATA: 
BASELINE [ X ] 
NEW [ ] 


R. WILSON 


ASSESSMENT: 


CRITICALITY 

FLIGHT 

HDW/FUNC 


REDUNDANCY SCREENS 
ABC 


CIL 

ITEM 


NASA [3/3 ] 

IOA [3/3 ] 


[ NA] [ NA] [ NA] 

[ NA] [ NA] [ NA] 


[ ] * 

[ ] 


COMPARE [ / 


] 


RECOMMENDATIONS : 


(If different from NASA) 


[/]•[] [ ] [ ] [ ] 

(ADD/DELETE) 


* CIL RETENTION RATIONALE: 


REMARKS: 


(If applicable) 

ADEQUATE [ 
INADEQUATE [ 


] 

] 


REPORT DATE 02/03/88 
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APPENDIX D 
CRITICAL ITEMS 


NASA FMEA MDAC ID ITEM 


02-6-A01-1 

101 

02-6-A01-1 

102 

02-6-A01-13 

103 

02-6-A01-SW-4 

104 

02-6-A01-SV-19 

106 

02-6-A01-FE-3 

107 

02-6-A01-FB-4 

111 

02— 6— AO 1— PS— 2 

114 

02— 6— A01— CV— 16 

115 

02-6-A01-CV-17 

116 

02-6-A01-LV-19 

117 

02-6-A01-LV-10 

118 

02— 6— A01— 6 

121 

02-6-A01-FA-23 

122 

02-6-A01-FA-23 

123 


SERVO ACTUATOR 

SERVO ACTUATOR 

SERVOACTUATOR 

SWITCH VALVE 
E-H SERVOVALVE 
FILTER 

MECHANICAL POSITION 
FEEDBACK ASSEMBLY 
POWER SPOOL 
CHECK VALVE 
CHECK VALVE 
LOCK VALVE 
LOCK VALVE 
CYLINDER AND RAM/ 
PISTON ASSEMBLY 
DYNAMIC PRESSURE 
FEEDBACK VALVE 


FAILURE MODE 


EXTERNAL LEAKAGE, 
COMPONENT 

RUPTURE DOWNSTREAM 

OF SWITCHING VALVE 

LEAKAGE, ELASTOMERIC 

SEAL FAILURE 

FAIL TO TRANSFER 

FAIL TO TRANSFER 

CLOGGED 

JAMMED OR 

SEPARATED 

JAMMED 

FAIL CLOSED 

FAIL OPEN 

FAIL CLOSED 

FAIL OPEN 

FRACTURE 

FAIL OPEN/CLOSED 
FAIL TO RETURN TO 
NULL 
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APPENDIX E 
DETAILED ANALYSIS 


This appendix contains the IOA analysis worksheets supplementing 
previous results reported in STSEOS Working Paper 1 . 0-WP-VA86001- 
06, Analysis of the ATVC Actuators, (3 December 1986) . Prior 
results were obtained independently and documented before 
starting the FMEA/CIL assessment activity. Supplemental analysis 
was performed to address failure modes not previously considered 
by the IOA. Each sheet identifies the hardware item being 
analyzed, parent assembly and function performed. For each 
failure mode possible causes are identified, and hardware and 
functional criticality for each mission phase are determined as 
described in NSTS 22206. Instructions for Preparation of FMEA and 
CIL . 10 October 1986 . Failure mode effects are described at the 
bottom of each sheet and worst case criticality is identified at 
the top. There were no supplemental analysis worksheets 
generated for the ATVC Actuators. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities: 

1 = Loss of life or vehicle 

2 = Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 = All others 


Functional Criticalities: 

1R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle. 

2R = Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission. 


Redundancy Screen A: 

1 = Is Checked Out PreFlight 

2 = Is Capable of Check Out PreFlight 

3 = Not Capable of Check Out PreFlight 

NA = Not Applicable 


Redundancy Screens B and C: 
P = Passed Screen 
F = Failed Screen 
NA = Not Applicable 
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APPENDIX F 


NASA FMEA TO IOA WORKSHEET CROSS REFERENCE 

This section provides a cross reference between the NASA FMEA 
and corresponding IOA analysis worksheet (s) included in Appendix 
E. The Appendix F comparison identifies the NASA FMEA Number, 
IOA Assessment Number, criticality and redundancy screen data, 
and IOA recommendations. 

Appendix F Legend. 

Code Definition 

All initial IOA criticality and redundancy screen 
differences were resolved with the NASA subsystem manager. 
In addition, the combining of like failures under one FMEA 
were agreed to. 
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NASA FMEA TO IOA WORKSHEET CROSS REFERENCE / RECOMMENDATIONS 
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